CVE-2026-103266 Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...

CVE-2026-103489

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible...

BIT-RABBITMQ-2026-67421 RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an...

EUVD-2026-90580

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible...

CVE-2026-103489

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible...

CVE-2026-103489

Versions of JetBrains YouTrack prior to 2026.2.19422 are vulnerable to an HTML injection flaw. This vulnerability exists within the VCS command failure notifications . No specific exploit information or direct remediation steps are provided in the documentation, though the issue is associated wit...

CVE-2026-103489

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible...

CVE-2026-67075

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this...

EUVD-2026-90498

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this...

CVE-2026-67075 HCL Digital Experience is affected by improper input sanitation

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this...

CVE-2026-67075

HCL Digital Experience is affected by improper input sanitation , which can lead to HTML injection . This vulnerability may be leveraged to perform content spoofing from a trusted domain. To address this issue, users should apply HCL Digital Experience 9.5 CF238 or later. No specific exploit deta...

PT-2026-103991

Name of the Vulnerable Software and Affected Versions GetSimple CMS versions prior to 1.5 Description The UpdateCE update form lacks anti-CSRF tokens, and the POST handler does not verify tokens or request origins. This allows a remote attacker to host a page that auto-submits a forged POST reque...

CVE-2026-100263

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

EUVD-2026-90007

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

CVE-2026-100263

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

CVE-2026-100263

JetBrains YouTrack versions prior to 2026.2.18991 are vulnerable to stored HTML injection . The vulnerability is triggered through the User-Agent header , allowing for the injection of malicious HTML content. The impact is categorized as Medium severity, with a CVSS score of 4.7 . Remediation is ...

swagger-ui

소개: Swagger UI의 역할 Swagger UI 는 OpenAPI이전 명칭 Swagger 명세를 대화형 웹 인터페이스로 렌더링하는 널리 사용되는 라이브러리입니다. 이를 통해 개발자와 통합자는 백엔드 구현 없이도 API를 탐색하고 테스트할 수 있습니다. CVE‑2018‑25031 상세 정보 근본 원인: 원격 명세 로딩 이 취약점은 Swagger UI 클라이언트가 원격 설정 또는 명세 파일을 로드하는 데 사용하는 URL 쿼리 매개변수의 유효성 검사가 불충분하여 발생합니다. 관련된 일반적인 매개변수는 다음과 같습니다...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 11.3.757 より前のバージョンは、CrushFTP 管理パネル（Reports / "Who Created Folder"）における保存型 HTML インジェクションに対して脆弱であり、管理者セッションでの永続的な HTML 実行を可能にします。 CWE CWE-79 — Web ページ生成時における入力の不適切な無効化（クロスサイトスクリプティング） CVSS v3.1 基本スコア: 4.1（中） AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N 修正されたバージョン ベンダーのチェンジログ（...

PT-2026-103310

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

CVE-2026-100263: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...